PatchTheCVECVE-2025-36752: Growatt ShineLan-X communication dongle has an undocumented backup account with undocumented credentials which
CVE-2025-36752 is a critical-severity flaw (CVSS 9.8) affecting shine lan-x firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Growatt ShineLan-X communication dongle has an undocumented backup account with undocumented credentials which allows significant level access to the device, such as allowing any attacker to access the Setting Center. This means that this is effectively backdoor for all devices utilizing a Growatt ShineLan-X communication dongle.
Why this priority
- Critical severity
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.3% (top 75%) |
| CISA exploited list | No |
| Weakness | CWE-798 |
| Published | 2025-12-13 |
| Last modified | 2026-10-07 |
Last updated 2026-10-07 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-36752?
shine lan-x firmware: upgrade to 3.6.0.2. Exact commands for each OS are on this page.
Is CVE-2025-36752 being exploited?
CVE-2025-36752 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-36752 affect?
CVE-2025-36752 affects shine lan-x firmware. Severity is critical (CVSS 9.8). Growatt ShineLan-X communication dongle has an undocumented backup account with undocumented credentials which allows significant level access to the device, such as allowing any attacker to access the Setting Center. This means that this i
How urgent is CVE-2025-36752?
Priority 46/100. Critical severity; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2025-36747 CRITICAL 9.8 UPGRADE ShineLan-X contains a set of credentials for an FTP server was found within the firmware, allowing testers to
- CVE-2025-36753 CRITICAL 9.8 UPGRADE The SWD debug interface on the Growatt ShineLan-X communication dongle is available by default, allowing an at
- CVE-2025-36748 MEDIUM 5.4 UPGRADE ShineLan-X contains a stored cross site scripting (XSS) vulnerability in the local configuration web server
- CVE-2025-36750 MEDIUM 5.4 UPGRADE ShineLan-X contains a stored cross site scripting (XSS) vulnerability in the Plant Name field